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REMARKS 

The final Office Action, rejected claim 28 under 35 U.S.C. § 103(a) as unpatentable over 
BOWMAN (U.S. Patent No. 5,627,886); and rejected claims 1-3, 5-27, 29-33, and 35-66 under 
35 U.S.C. § 103(a) as unpatentable over BOWMAN in view of PHELPS (U.S. Patent No. 
5,602,906). Applicants respectfully traverse these rejections. 1 

By this Amendment, Applicants propose amending claims 1, 6, 7, 10-13, 17, 22-24, 27, 

29, 31, 32, 42, 46, 51, 58, 59, 61 and 64-66 to improve form. Applicants propose canceling 
claims 28 and 30, without prejudice to or disclaimer of the subject matter thereof. Applicants 
further propose adding new claim 67 to recite subject matter similar to canceled claims 28 and 

30. No new matter has been added by way of the present Amendment. Claims 1-3, 5-27, 29, 31- 
33, and 35-67 would be pending upon entry of the present amendment. 

The Office Action rejected claim 28 under 35 U.S.C. § 103(a) as allegedly unpatentable 
over BOWMAN. The rejection of claim 28 is moot because Applicants propose canceling claim 
28 by this amendment. 

Claim 1-3, 5-27, 29, 31-33, and 35-66 stand rejected under 35 U.S.C. § 103(a) as 
allegedly unpatentable over BOWMAN in view of PHELPS. Applicants respectfully traverse 
this rejection with respect to the claims as currently amended. 

Independent claim 1, for example, is directed to a method for detecting fraud in one of a 
credit card or debit card system, the system generating network event records, each network 

1 As Applicants' remarks with respect to the Examiner's rejections are sufficient to overcome these rejections. 
Applicants' silence as to assertions by the Examiner in the Office Action or certain requirements that may be 
applicable to such rejections (e.g., whether a reference constitutes prior art, motivation to combine references, 
assertions as to dependent claims, etc.) is not a concession by Applicants that such assertions are accurate or such 
requirements have been met, and Applicants reserve the right to analyze and dispute such assertions/requirements in 
the future. 
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event record being generated in response to an event in the system, the method including 

performing at least a first fraud detection test and a second different fraud detection test on the 

network event records; generating a first fraud alarm upon detection of suspected fraud by the 

first fraud detection-test; generating a second different fraud alarm upon detection of suspected 

fraud by the second different fraud detection test; correlating the generated first fraud alarm with 

the generated second different fraud alarm based on common aspects of the first fraud alarm and 

the second different fraud alarm, the correlated fraud alarms being consolidated into a fraud case, 

the fraud case being assigned a priority based on a severity of the suspected fraud; and 

responding to the fraud case with a fraud prevention action, the fraud prevention action being 

based on the priority assigned to the fraud case. BOWMAN and PHELPS, either individually or 

in combination, do not disclose the above combination of features. 

For example, BOWMAN and PHELPS do not disclose or suggest correlating the 
generated first fraud alarm with the generated second different fraud alarm based on common 
aspects of the first fraud alarm and the second different fraud alarm, the correlated fraud alarms 
being consolidated into a fraud case, the fraud case being assigned a priority based on a severity 
of the suspected fraud, as recited in claim 1, amended as proposed. The Office Action 
acknowledges that BOWMAN does not disclose or suggest correlating fraud alarms based on 
common aspects of the fraud alarms, the correlated fraud alarms being consolidated into a fraud 
case, the fraud case being assigned a priority based on a severity of the suspected fraud (final 
Office Action, page 5). The Office Action cites to PHELPS to cure the above deficiency (final 
Office Action, page 5). 

However, PHELPS does not disclose or suggest correlating the generated first fraud 
alarm with the generated second different fraud alarm based on common aspects of the first fraud 
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alarm and the second different fraud alarm, the correlated fraud alarms being consolidated into a 

fraud case, the fraud case being assigned a priority based on a severity of the suspected fraud, as 

recited in claim 1, amended as proposed. The Office Action cited to col. 2, lines 30-40, col. 2, 

line 63 - col. 3, line 5, and col. 4, lines 40-50 of PHELPS as allegedly disclosing correlating 

fraud alarms based on common aspects of the fraud alarms, the correlated fraud alarms being 

consolidated into a fraud case, the fraud case being assigned a priority based on a severity of the 

suspected fraud (final Office Action, page 5). Applicants respectfully submit that neither these 

sections nor any other sections of PHELPS disclose or suggest correlating the generated first 

fraud alarm with the generated second different fraud alarm based on common aspects of the first 

fraud alarm and the second different fraud alarm, the correlated fraud alarms being consolidated 

into a fraud case, the fraud case being assigned a priority based on a severity of the suspected 

fraud, as recited in claim 1, amended as proposed. 

Col. 2, lines 30-40 of PHELPS discloses: 

Apparatus 10 receives call placement information and customer information from 
network 12. This information is used to update the history information stored in 
apparatus 10. Apparatus 10 generates an indication of unauthorized use of a 
billing number by applying the call placement and history information to a set of 
expert system rules. The indication is a case that is generated from an alert and 
assigned a priority. The case is resolved by a set of expert system rules or a 
researcher, and network 12 acts on the resolution. 

This section of PHELPS discloses an apparatus that generates indications of authorized usage of 

a billing number by applying call placement and history information to a set of expert system 

rules. While this section of PHELPS mentions the word "case," nowhere in this section, or 

elsewhere, does PHELPS disclose or suggest correlating a first fraud alarm (generated by a first 

fraud detection test) with a second different fraud alarm (generated by a second different fraud 

detection test) based on common aspects of the fraud alarms, where the correlated fraud alarms 
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are consolidated into a fraud case, and where the fraud case is assigned a priority based on a 

severity of the suspected fraud, as recited by claim 1, amended as proposed. 

Col. 2, line 63 - col. 3, line 5 of PHELPS states: 

SCPMS 44 processes call attempt information and produces alerts that are provided to 
SCPMS gateway 18. These alerts are generated for LEC and IXC calling cards only 
when the number of attempts to use a calling card exceeds a predetermined threshold. 
The threshold is dependant in part on the type of product and the geographic dispersion 
of the call origination points. SCPMS gateway 18 analyzes the alerts based on a set of 
expert system rules for the detection of fraudulent call activity, and generates alerts based 
on the SCPMS alerts to send to central computer 20 for further analysis. 

In this section, PHELPS discloses that a SCPMS gateway generates alerts when attempts to use a 

calling card exceed a predetermined threshold. Nowhere in this section, or elsewhere, does 

PHELPS disclose or suggest correlating a first fraud alarm (generated by a first fraud detection 

test) with the second different fraud alarm (generated by a second different fraud detection test) 

based on common aspects of the fraud alarms, where the correlated fraud alarms are consolidated 

into a fraud case, and where the fraud case is assigned a priority based on a severity of the 

suspected fraud, as recited by claim 1, amended as proposed. 

Col. 4, lines 40-50 of PHELPS states: 

The expert system rules are configured empirically on the basis of actual cases of 
unauthorized billing number usages. With this approach, the rules can be continuously 
updated and refined to reflect learning experiences concerning newly detected cases of 
toll fraud, and customized for each type of billing number. Thus, those skilled in the art 
will appreciate that the rules are not fixed, but are continuously evolving in order to adapt 
to the most current conditions. 

In this section, PHELPS discloses that expert system rules may be updated to reflect learning 

experiences concerning newly detected toll fraud. Nowhere in this section, or elsewhere, does 

PHELPS disclose or suggest correlating a first fraud alarm (generated by a first fraud detection 

test) with the second different fraud alarm (generated by a second different fraud detection test) 

based on common aspects of the fraud alarms, where the correlated fraud alarms are consolidated 
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into a fraud case, and where the fraud case is assigned a priority based on a severity of the 

suspected fraud, as recited by claim 1, amended as proposed. 

Claim 1 also recites responding to the fraud case with a fraud prevention action, the fraud 
prevention action being based on the priority assigned to the fraud case. BOWMAN and 
PHELPS, either individually or in combination, do not disclose this feature. 

The Office Action also acknowledged that BOWMAN does not disclose or suggest 
responding to the fraud case with a fraud prevention action, the fraud prevention action being 
based on the priority assigned to the fraud case. The Office Action cited to col. 2, lines 30-40 
and col. 2, line 63 - col. 3, line 5 of PHELPS as allegedly disclosing the above feature (final 
Office Action, page 5). Applicants respectfully disagree with the Examiner's interpretation of 
PHELPS. 

Col. 2, lines 30-40 of PHELPS, as reproduced above, discloses an apparatus that 
generates indications of authorized usage of a billing number by applying call placement and 
history information to a set of expert system rules. While this section of PHELPS mentions the 
word "case," nowhere in this section, or elsewhere, does PHELPS disclose or suggest responding 
to the fraud case with a fraud prevention action, the fraud prevention action being based on the 
priority assigned to the fraud case, as recited in claim 1. 

Col. 2, line 63 - col. 3, line 5 of PHELPS, as reproduced above, discloses that a SCPMS 
gateway generates alerts when attempts to use a calling card exceed a predetermined threshold. 
Nowhere in this section, or elsewhere, does PHELPS disclose or suggest responding to the fraud 
case with a fraud prevention action, the fraud prevention action being based on the priority 
assigned to the fraud case, as recited in claim 1. 
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For at least these reasons, Applicants submit that claim 1 is patentable over BOWMAN 
and PHELPS, whether taken alone or in any reasonable combination. Claims 2, 3, and 5-27 
depend from claim 1 and are, therefore, patentable over BOWMAN and PHELPS, whether taken 
alone or in any reasonable combination, for at least the reasons given with regard to claim 1. 
Thus, Applicants respectfully request that the Examiner reconsider and withdraw the rejection of 
claim 1 under 35 U.S.C. § 103(a) over BOWMAN and PHELPS. 

New claim 67 recites subject matter similar to (yet of possibly different scope than) 
canceled claims 28 and 30. Accordingly, new claim 67 is discussed below as if the rejections of 
canceled claims 28 and 30 were applied to it. 

New claim 67, for example, recites a system for monitoring one or more of a plurality of 
credit card or debit card networks, each network being configured to generate network event 
records, each network event record being generated in response to an event occurring in the 
network. The system includes a detection element configured to generate a first fraud alarm if a 
network event record is in violation of a first fraud detection rule, the detection element 
generating a second different fraud alarm if a network event record is in violation of a second 
different fraud detection rule, the first fraud alarm and the second different fraud alarm having at 
least one common aspect; an analysis element configured to correlate the first fraud alarm and 
the second different fraud alarm, and generate a fraud case based on the correlated fraud alarms; 
and an expert element configured to assign a priority to the fraud case, and to perform a fraud 
prevention action in accordance with the priority. BOWMAN and PHELPS, whether taken 
alone or in any reasonable combination, do not disclose or suggest this combination of features. 

For example, BOWMAN and PHELPS do not disclose or suggest a detection element 
configured to generate a first fraud alarm if a network event record is in violation of a first fraud 
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detection rule, the detection element generating a second different fraud alarm if a network event 
record is in violation of a second different fraud detection rule, the first fraud alarm and the 
second different fraud alarm having at least one common aspect. The Office Action relied on 
col. 2, lines 25-40 of BOWMAN for allegedly disclosing this feature. Applicants respectfully 
disagree with the Examiner's interpretation of BOWMAN. 
Col. 2, lines 26-39 of BOWMAN discloses: 

In the accomplishment of these and other objects, a computerized system and 
method for detecting fraudulent network usage patterns using real-time network 
monitoring of at least two disparate networks is shown which receives at least one 
event record from each of the disparate networks, analyzes each of the received 
event records to determine its type based on user-defined parameters, identifies 
predetermined fields in the analyzed event record to be used as keys, measures 
network usage associated with the key, summarizes usage statistics against at least 
one of the keys, compares statistic totals to predefined thresholds, and responds 
with an alarm or the like when the thresholds are met or exceeded. 

This section of BOWMAN discloses that a single alarm is generated when statistic totals are 
compared to and exceed predetermined thresholds. This section of BOWMAN merely discloses 
that the generation of alarms are based on predetermined thresholds and does not describe a 
detection element configured to generate a first fraud alarm if a network event record is in 
violation of a first fraud detection rule, the detection element generating a second different fraud 
alarm if a network event record is in violation of a second different fraud detection rule, the first 
fraud alarm and the second different fraud alarm having at least one common aspect, as recited in 
new independent claim 67. The disclosure of PHELPS does not remedy the above deficiency in 
the disclosure of BOWMAN. 

Claim 67, as proposed, also recites an analysis element configured to correlate the first 
fraud alarm and the second different fraud alarm, and generate a fraud case based on the 
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correlated fraud alarms, as recited in new independent claim 67, as proposed. This feature is 

similar to (yet possibly of different scope than) a feature previously recited in canceled claim 30. 

The Office Action relied on col. 2, lines 25-40 of BOWMAN for allegedly disclosing the above 

feature previously recited in canceled claim 30. Applicants respectfully disagree with the 

Examiner's interpretation of BOWMAN. 

Col. 2, lines 26-39 of BOWMAN, as reproduced above, discloses that an alarm is 
generated when statistic totals are compared to and exceed predetermined thresholds. This 
section of BOWMAN merely discloses that the generation of alarms are based on predetermined 
thresholds and does not describe an analysis element configured to correlate a first fraud alarm 
(generated by a first fraud detection test) and the second different fraud alarm (generated by a 
second different fraud detection test), and generate a fraud case based on the correlated fraud 
alarms, as recited in new independent claim 67, as proposed. The disclosure of PHELPS does 
not remedy the above deficiency in the disclosure of BOWMAN. 

For at least these reasons, Applicants submit that claim 67 is patentable over BOWMAN 
and PHELPS. Claims 29, 31-33 and 35-66 depend from claim 67 and are, therefore, patentable 
over BOWMAN and PHELPS for at least the reasons given with regard to claim 67, as proposed. 

In light of the above, Applicants respectfully request the reconsideration and withdrawal 
of the 35 U.S.C. § 103(a) rejection of claims 1-3, 5-27, 29, 31-33, and 35-66 as allegedly 
unpatentable over BOWMAN and PHELPS. 

CONCLUSION 

In view of the foregoing amendments and remarks, Applicants respectfully request the 
Examiner's reconsideration of the application and the timely allowance of pending claims 1-3, 5- 
27, 29, 31-33, and 35-67. Applicants respectfully request entry of the present amendment 
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because the present amendment does not raise new issues or require a further search of the art 

since the features were previously examined by the Examiner. Moreover, Applicants submit that 

the present amendment places the application in better condition for appeal should the Examiner 

contest the patentability of the pending claims. 

If the Examiner does not believe that all pending claims are now in condition for 

allowance, the Examiner is urged to contact the undersigned to expedite prosecution of this 

application. 

To the extent necessary, a petition for an extension of time under 37 C.F.R. § 1.136 is 
hereby made. Please charge any shortage in fees due in connection with the filing of this paper, 
including extension of time fees, to Deposit Account No. 50-1070 and please credit any excess 
fees to such deposit account. 

Respectfully submitted, 
Harrity Snyder, L.L.P. 



By: /John E. Harrity, Reg. No. 43367/ 
John E. Harrity 
Reg. No. 43,367 

Date: February 1, 2008 
1 1350 Random Hills Road 
Suite 600 

Fairfax, Virginia 22030 
Phone: (302) 478-4548 
Fax: (571)432-0808 
CUSTOMER NUMBER: 25537 
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